Privacy Policy

This policy explains how OCHO LLC d/b/a Kwakkwak, operating the Kwakkwak service, handles information for its public site, founder-pilot applications, invited accounts, and controlled pilot service. The applicable pilot order identifies the participating shop and any pilot-specific terms.

For shop customer data, the shop generally decides why and how the data is used and Kwakkwak processes it on the shop's behalf. For account, application, billing, support, security, and site-operation data, Kwakkwak may determine the relevant processing purposes.

We may collect application and account details such as name, work email, phone, shop name, location, website, booking platform, customer-count range, goals, source attribution, legal acceptance versions and timestamps, login records, and support communications.

Approved pilot data may include customer names, normalized phone numbers, emails, external IDs, appointments, services, purchase and revenue history, source files and hashes, export or connected-account metadata, selected locations, consent scope and language, opt-in and opt-out evidence, suppression records, owner attestations, reviews, notes, and recorded outcomes.

Service systems may generate device, browser, IP, request, audit, authentication, security, performance, and error data. Payment providers may collect payment details directly; Kwakkwak should receive transaction and billing status rather than full card data.

We use information to review pilot fit; create and secure invited accounts; connect and synchronize owner-authorized Square data; privately stage and review approved fallback files; analyze customer return patterns; produce owner-reviewed recovery work; maintain consent and suppression evidence; support the service; prevent abuse; troubleshoot; maintain audit and recovery records; process approved payments; and meet legal or contractual obligations.

Uploaded files are not treated as instructions to automated systems. SMS is limited to separately consented recipients and remains subject to the applicable campaign authorization, sender registration, suppression controls, and launch gates.

A phone export alone is not consent. Kwakkwak may retain evidence showing the shop, sender, scope, language, source, timestamp, review status, later opt-outs, suppressions, and owner approvals. Owner attestation records responsibility but cannot substitute for customer consent.

The Kwakkwak Pilot SMS program is limited to direct Kwakkwak users and invited pilot testers who enroll themselves at the public SMS enrollment page using an unchecked consent box. Kwakkwak records the submitted number, consent timestamp, source page, and disclosure version. Messages may include requested test confirmations, pilot or account updates, support replies, and product-feedback requests. Message frequency varies and remains low. Message and data rates may apply. Reply STOP to opt out or HELP for help.

We do not sell, rent, or share mobile phone numbers or SMS consent records with third parties or affiliates for their marketing or promotional purposes. We may disclose them to service providers such as Twilio only as needed to deliver, secure, support, or document the messaging service, or when required by law. Client-customer messaging requires separate shop-specific consent evidence, sender and campaign registration, suppression enforcement, owner approval, runtime gates, and legal review.

See Twilio's Messaging Policy and Privacy Notice.

For an owner-approved shop email campaign, Kwakkwak may process the recipient email address, the exact approved message and audience snapshot, delivery status, bounce or complaint status, unsubscribe evidence, and message identifiers needed to prevent duplicate sends and enforce suppressions.

Shop emails may use Amazon SES open and click tracking. An open may be generated by automated image loading, privacy protection, or security scanning, and a click may be generated by automated link inspection. Kwakkwak does not treat either signal as proof of identity, consent, a booking, or a purchase. Recipients can unsubscribe using the link in the email.

Current or planned service providers may include Supabase for database, private storage, and authentication; Vercel for application hosting; Stripe for an approved payment flow; Twilio for separately approved shop-owned messaging; and Amazon SES for separately approved shop email delivery, suppression handling, and delivery, open, and click events. Square data is handled through an owner-authorized OAuth connection with webhook-driven updates, scheduled reconciliation, and limited customer-group management for owner-reviewed Square campaigns. Kwakkwak does not send Square Marketing campaigns. Other booking sources use assisted exports unless a separate connection is disclosed and authorized.

The Square connection stores application-encrypted authorization credentials, selected-location metadata, signed-webhook receipts, encrypted minimized audit snapshots, and normalized customer and visit records needed for the pilot. Connecting Square does not create SMS marketing consent, and disconnecting revokes Square access and removes the local credential envelope.

Relevant vendor privacy materials include the Supabase DPA, Vercel Privacy Notice and DPA, and the Stripe Privacy Center.

We may also disclose information when directed by the shop, required by law, needed to protect rights or safety, necessary to investigate abuse, or part of a business transaction subject to appropriate safeguards. We do not sell shop customer lists.

Application, account, shop, and pilot data is retained only as reasonably needed for pilot review and delivery, security, dispute handling, backup and recovery, legal obligations, and documented business records. Rejected applications should be deleted or de-identified on a defined schedule after counsel review.

Consent, opt-out, suppression, sender, attestation, audit, and payment records may be retained longer where needed to demonstrate compliance or resolve disputes. Deletion requests may be limited by legal, security, billing, backup, or compliance-retention needs.

Kwakkwak uses measures intended to reduce risk, including private file staging, organization-scoped paths and policies, authentication, limited service credentials, hashes, audit records, and release gates. No security measure eliminates all risk. Shops should minimize unnecessary data and promptly report suspected unauthorized access.

Vendors may process data in the United States and other countries where they or their subprocessors operate, subject to their contractual and legal transfer mechanisms.

Shop owners may ask to access, correct, export, or delete account and shop data. A shop's customer should normally direct a request to that shop, which controls the underlying customer relationship; Kwakkwak will assist the shop as appropriate. Shop marketing emails sent through Kwakkwak may be opted out of using the message instructions.

The service is for businesses and is not directed to children. Do not submit children's personal information.

We may update this policy as the pilot changes. Material updates will receive a new version and effective date, and renewed acceptance will be requested where appropriate.

This policy is not legal advice or a claim of regulatory certification. Questions or requests: contact@kwakkwak.app.